I've found the esc_url() function and I'm trying to understand what to do with URLs in Wordpress, before resorting to my normal PHP tactics. I see that the third parameter is used to set the filter that runs on it, with the default value of 'display'. This is for display on a webpage. I grepped the WP source code for examples of the use of the third parameter and found but a single example:
$ grep -rP "esc_url.*\([^\)\,]*\,[^\)\,]*\, ?'?\"?.*\)" * wp-includes/formatting.php: return esc_url( $url, $protocols, 'db' );
All other matches to
grep were for irrelevant invocations, such as the use of another function call's return value as an
Other than 'display' and 'db', what other values should be used and when? I see quite a few places in the WP source code where the display value is used in an href, here is an example:
$ grep -r esc_url * | grep href wp-admin/themes.php: <td><a href="<?php echo esc_url( $delete_url ); ?>" class="button button-secondary delete-theme"><?php _e( 'Delete' ); ?></a></td>
Should the 'display' value really be used for an href attribute? It seems to me that it does some encoding that I would not trust to return always to proper URL afterward, especially for non-ASCII URLs.
Is this a bug in WP that the 'dispaly' filter is being used for actual URLs, or should I use the 'display' filter for actual URLs in my own code as well?